Clamav modules still disabled even though security issues are fixed

[Scott Kitterman]

Binary package hint: clamav

We've patched the security issues in 0.92.1, but not re-enabled the relevant modules. Upstream has included and I've backported the patch.

[Scott Kitterman (kitterman)]

Here's the debug output showing the same modules enabled as we get in 0.94.whicheveronewe'reonnow.

LibClamAV debug: Dynamic engine configuration settings:
LibClamAV debug: --------------------------------------
LibClamAV debug: Module PE: On
LibClamAV debug: * Submodule PARITE: On
LibClamAV debug: * Submodule KRIZ: On
LibClamAV debug: * Submodule MAGISTR: On
LibClamAV debug: * Submodule POLIPOS: On
LibClamAV debug: * Submodule MD5SECT: On
LibClamAV debug: * Submodule UPX: On
LibClamAV debug: * Submodule FSG: On
LibClamAV debug: * Submodule PETITE: On
LibClamAV debug: * Submodule PESPIN: On
LibClamAV debug: * Submodule YC: On
LibClamAV debug: * Submodule WWPACK: On
LibClamAV debug: * Submodule NSPACK: On
LibClamAV debug: * Submodule MEW: On
LibClamAV debug: * Submodule UPACK: On
LibClamAV debug: * Submodule ASPACK: On
LibClamAV debug: Module ELF: On
LibClamAV debug: Module ARCHIVE: On
LibClamAV debug: * Submodule RAR: On
LibClamAV debug: * Submodule ZIP: On
LibClamAV debug: * Submodule GZIP: On
LibClamAV debug: * Submodule BZIP: On
LibClamAV debug: * Submodule ARJ: On ...

[Scott Kitterman (kitterman)]

Debdiff verified in a Hardy chroot. Did not run the regression tests.

[Scott Kitterman (kitterman)]

Working on Gutsy/Dapper. This bug will apply to Intrepid/Jaunty as soon as 0.95 is released.

[Scott Kitterman (kitterman)]

Added closes in changelog and renamed debdiff to include release name.

[Scott Kitterman (kitterman)]

Debdiff for Gutsy. Also includes work from Bug #271546 not previously uploaded

[Scott Kitterman (kitterman)]

Debdiff for Dapper. Also includes work from Bug #271546 not previously uploaded

[Jamie Strandboge (jdstrand)]

Thanks Scott. I've uploaded these to the security PPA and they will be published on Monday.

[Launchpad Janitor (janitor)]

This bug was fixed in the package clamav - 0.92.1~dfsg2-1.1~gutsy3.1ubuntu2

---------------
clamav (0.92.1~dfsg2-1.1~gutsy3.1ubuntu2) gutsy-security; urgency=low

  [ Leonel Nunez ]
  * SECURITY UPDATE:
  * [CVE-2008-5314]: remote attack by sending a specially crafted JPEG file
    libclamav/special.c, libclamav/special.h, libclamav/scanners.c
  * [CVE-2008-3912]: libclamav/mbox.c, libclamav/message.c: out-of-memory
    null dereferences
  * [CVE-2008-3914]: libclamav/htmlnorm.c, libclamav/others.c,
    libclamav/sis.c: fd leaks
  * [CVE-2008-3913]: freshclam/manager.c: memory leaks
  * added 29_CVE-2008-3912.dpatch 30_CVE-2008-3913.dpatch
     32_cli_check_jpeg_exploit.dpatch 31_CVE-2008-3914.dpatch
  * References: LP #271546, #304017

  [ Scott Kitterman ]
  * SECURITY UPDATE: re-enable modules disabled due to resolved security
    deficiencies:
  * References: Clamav svn commit 4550 LP: #317923

 -- Scott Kitterman <email address hidden> Sat, 17 Jan 2009 23:57:18 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package clamav - 0.92.1~dfsg2-1.1ubuntu0.5

---------------
clamav (0.92.1~dfsg2-1.1ubuntu0.5) hardy-security; urgency=low

  * SECURITY UPDATE: re-enable modules disabled due to resolved security
    deficiencies:
  * References
  * Clamav svn commit 4550 LP: #317923

 -- Scott Kitterman <email address hidden> Fri, 16 Jan 2009 02:07:38 -0500

[Jamie Strandboge (jdstrand)]

clamav (0.92.1~dfsg2-1.1~dapper3.3) dapper-security; urgency=low

  [ Leonel Nunez ]
  * SECURITY UPDATE:
  * [CVE-2008-5314]: remote attack by sending a specially crafted JPEG
    file
    libclamav/special.c, libclamav/special.h, libclamav/scanners.c
  * [CVE-2008-3912]: libclamav/mbox.c, libclamav/message.c:
    out-of-memory null dereferences
  * [CVE-2008-3914]: libclamav/htmlnorm.c, libclamav/others.c,
    libclamav/sis.c: fd leaks
  * [CVE-2008-3913]: freshclam/manager.c: memory leaks
  * added 29_CVE-2008-3912.dpatch 30_CVE-2008-3913.dpatch
     32_cli_check_jpeg_exploit.dpatch 31_CVE-2008-3914.dpatch
  * References: LP #271546, #304017

  [ Scott Kitterman ]
  * SECURITY UPDATE: re-enable modules disabled due to resolved security
    deficiencies:
  * References: Clamav svn commit 4550, LP #317923

[Jamie Strandboge (jdstrand)]

All of these issues are fixed in Intrepid and higher.